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qq ■ We study the simultaneous message passing (SMP) model of communication complexity, 

^NJ \ for the case where one party is quantum and the other is classical. We show that in an SMP 

protocol that computes some function with the first party sending q qubits and the second 

' (-h ', sending c classical bits, the quantum message can be replaced by a randomized message of 

O |' 0(qc) classical bits, as well as by a deterministic message of 0(qc log q) classical bits. Our 

proofs rely heavily on earlier results due to Scott Aaronson [TJ [2] . 

In particular, our results imply that quantum-classical protocols need to send Q(y/n/ logn) 
bits/qubits to compute Equality on n-bit strings, and hence are not significantly better than 
classical-classical protocols (and are much worse than quantum-quantum protocols such as quan- 
tum fingerprinting) . This essentially answers a recent question of Wim van Dam [7] . Our results 
also imply, more generally, that there are no superpolynomial separations between quantum- 
classical and classical-classical SMP protocols for functional problems. This contrasts with 
the situation for relational problems, where exponential gaps between quantum-classical and 

l/~j | classical-classical SMP protocols are known. We show that this surprising situation cannot arise 

in purely classical models: there, an exponential separation for a relational problem can be 
converted into an exponential separation for a functional problem. 

o. 

oo , 1 Introduction 

O 

We consider the simultaneous message passing (SMP) model of communication complexity. Here 
Alice receives input x and Bob receives input y. They each send one message to a third party, 
called the "referee." Given the two messages, the referee outputs a value which should equal the 
function value f(x,y) with probability at least, say, 2/3. 

We are interested in comparing classical and quantum SMP protocols. Consider for instance 
the Equality function: x,y G {0, l} n , and f(x,y) = 1 iff x = y. If Alice and Bob do not share 
randomness, then this function exhibits an exponential quantum-classical gap: there is an SMP 
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protocol for / where Alice and Bob each send O(logra) quantum bits to the referee [6], using a 
technique called "quantum fingerprinting." On the other hand, if the messages are classical, then 
B(y / n)-bit messages are necessary and sufficient [2l[T2j|3], as we will explain in Section [3l 

Here we consider a question recently asked by Wim van Dam [7J: what happens if one of 
the messages (say Alice's) is quantum, while the other is restricted to be classical? We call such 
protocols quantum- classical SMP protocols. For instance, one may ask whether some variant of 
quantum fingerprinting still works if one of the two messages is classical. 

Our main results here say that the quantum message can be "simulated" by a classical message 
that is only moderately larger. More specifically, we show that the following hold for protocols 
computing a Boolean function: 

• In Theorem 0] we show that a private-coin (resp. public-coin) quantum-classical protocol 
where Alice sends q qubits and Bob sends c bits, gives a private-coin (resp. public-coin) 
classical-classical protocol where Alice sends a randomized 0(qc)-bit message and Bob sends 
a randomized c-bit message. 

• In Corollary [6] we show that a private-coin quantum-classical protocol where Alice sends q 
qubits and Bob sends c bits, gives a private-coin classical-classical protocol where Alice sends 
a deterministic O^clogg^-bit message and Bob sends a randomized c-bit message. 

Our proofs rely heavily on earlier results in the one-way communication model by Aaronson [H [2] . 

The latter result implies that quantum-classical private-coin protocols for Equality need to 
send Q(^n/logn) bits and/or qubits. This is not significantly better than the Q(^/n) bits that 
are necessary and sufficient for classical protocols. 

The results above are rather unusual in communication complexity, where typically introducing 
quantum elements gives exponentially more power for at least some problems. The exponential 
improvements given by the quantum-quantum fingerprinting protocol is a prime example of this. 
This is also the case with one-way communication complexity, where we know Boolean functions 
whose quantum complexity is exponentially smaller than their classical complexity [8j. As another 
example, Gavinsky et al. [8] exhibit a function with an exponential gap between classical-classical 
SMP protocols with shared entanglement and those with only shared randomness. Yet another 
example is obtained when considering relations instead of functions in our model [5] . We elaborate 
on this in Section [7J 

2 Preliminaries 

We assume familiarity with quantum computing [13] and with the basic notions of classical and 
quantum communication complexity [101 [T3] ■ Informally, the setting of communication complexity 
is as follows. Alice receives some input x G X, Bob receives some input y £ Y, and together they 
want to compute some function f(x,y), with error probability at most 1/3 for all (x,y) in some 
domain T> C X x Y. ItT) = X xY then the problem is called total, otherwise it is called partial. 
A Boolean function / has range {0,1}. The communication matrix Mf corresponding to / is the 
\X\ x |1"| matrix whose (x,y)-entry equals f(x,y) if (x,y) £ T>, and equals '*' otherwise. 

In the simultaneous message passing (SMP) model, Alice and Bob each send a message to a 
third party (called the referee), who then computes the output. In the one-way model Alice sends 
one message to Bob (no referee here), while in the two-way model they can interact arbitrarily. 



The cost of a communication protocol is its total communication on the worst-case input. The 
(bounded-error) communication complexity of / (in one of the above models) is the minimal cost 
among all protocols that compute / with probability of error at most 1/3 for each input. 

Classical protocols may be deterministic or randomized. When dealing with randomness, we 
have to distinguish between private coins and public coinsl] The former are visible only to individual 
parties, while the latter are shared among all parties and may help them coordinate their actions. In 
one-way and two-way models, the difference between public-coin and private-coin communication 
complexity is at most an additive O(logn) bits [11], but in the SMP model it can make a big 
difference. In particular, while the private-coin SMP complexity of Equality is G(y / n) bits, its 
public-coin complexity is constant: the protocol picks a shared random n-bit string r, Alice and 
Bob send the inner product of their input with r (mod 2) to the referee, who checks whether the 
two received bits are equal. 

The following theorem can be derived from the proof of [2, Theorem 1.4]. Here by a measurement 
operator E we mean a positive semidefinite matrix with eigenvalues in [0,1]. The acceptance 
probability of the two-outcome measurement with operators E and I — E on density matrix p is 
p = Tr (Ep). 

Theorem 1 (Aaronson). For all 5 > the following holds. Suppose Alice has the classical descrip- 
tion of an arbitrary q-qubit density matrix p and Bob has a measurement operator E £ {Eb}b£{o,i} c - 
Then Alice can send Bob a randomized 0(qc)-bit message that enables him to output a value p' that 
approximates p = Tr (Ep) in the following sense: with probability at least 1 — 5 we have \p — p'\ < S 
(the constant in the O(-) depends on 5, and no public coin is used). 

3 Warmup: replacing a randomized message by deterministic 

Our goal in this paper is to replace a quantum message by a randomized or deterministic one 
that is not much bigger. Let us first consider a known case: replacing a randomized message by a 
deterministic one. Babai and Kimmel [4] showed the following. If there is a bounded-error private- 
coin SMP protocol for a Boolean function /, where Alice sends ca bits and Bob sends cb bits, then 
there exists another bounded-error private-coin SMP protocol for / where Alice deterministically 
sends O(cacb) bits, and Bob (who is still randomized) sends cb bits. 

As an application of this result, note that in any bounded-error protocol for Equality where 
Alice is deterministic, she needs to send a different message for each of the 2 n inputs x: if she 
sends the same message for x and for x', then the referee will have the same acceptance probability 
on inputs (x, x) and (x', x) and hence on at least one of those pairs he will err with probability 
at least 1/2. This implies that in any bounded-error private-coin SMP protocol for Equality, 
n < 0(ca.cb), and hence we obtain the bound ca + cb > £l(y/n) mentioned in the introduction. 

As a warm-up for the results in the next sections, we sketch a simple proof of the Babai- 
Kimmel result here. Consider any Boolean function /, partial or total, and a bounded-error private- 
coin SMP protocol for /. Let r(a, b) € [0, 1] denote the referee's acceptance probability if he 
receives message a G {0, 1} CA from Alice and b £ {0, l} Cs from Bob. We use A x for the random 
variable which is Alice's message (its distribution depends on her input x), and similarly B y for 
Bob's message. Note that for every input x, y where / is defined, the acceptance probability 
^a~A x ,b~By[r(a,b)] approximates the function value: \f(x,y) - E a ^ Ax ,b~B y [r(a,b)]\ < 1/3. 



1 We will not consider models with shared entanglement here. 



We now modify the protocol as follows. Let Alice send her (probabilistic) message s ■ cb times, 
for some integer s to be determined later, at a total communication cost of scacb bits. For a fixed 
message b from Bob, the referee computes p b , defined as the average of r(at, b) over all messages a% 
received from Alice. Choosing s a sufficiently large constant, the Chernoff bound implies that p b is 
within 1/10 of its expectation p b = ¥. a ^A x [K a > b)], except with probability <C 2~ Cs : 

Pv[\p b -p b \ >1/10]«2- Cfl . 

Hence by a union bound, there exists a deterministic message from Alice that would cause the 
approximations p b to be 1/10-close to p b simultaneously for all b e {0, 1} CB . The desired protocol 
is clear now: Alice, given her input x, sends the sc^ce-bit deterministic message described above. 
The referee uses this information to compute a value p b such that \p b — p b \ < 1/10 where b is the 
message he received from Bob, and accepts with probability p b . Clearly, for each input pair x, y the 
acceptance probability of this protocol differs from that of the original protocol by at most 1/10, 
and hence correctness is maintained. We have reproved: 

Theorem 2 (Babai & Kimmel). Let f be a (possibly partial) Boolean function. If there is a 
bounded-error private-coin SMP protocol for f where Alice sends ca bits and Bob sends cb bits, 
then there is a bounded-error private-coin SMP protocol for f where Alice deterministically sends 
0(cacb) bits, and Bob (who is still randomized) sends cb bits. 

Actually, Babai and Kimmel showed something slightly stronger, namely that both Alice's and 
Bob's randomized message can simultaneously be replaced by deterministic messages of length 
0{c A c B )- 

Theorem 3 (Babai & Kimmel). Let f be a (possibly partial) Boolean function. If there is a 
bounded-error private-coin SMP protocol for f where Alice sends ca bits and Bob sends cb bits, 
then there is a deterministic SMP protocol for f where Alice and Bob send 0{cacb) bits. 

This theorem is essentially tight for the EQUALITY problem, where the deterministic commu- 
nication complexity is 2n. Consider the following bounded-error private-coin protocol, adapted 
from pjj. Alice and Bob fix, beforehand, a good error-correcting code C : {0, l} n — > {0, l} m with 
m = 0(n). For m = cacb, they can view the codewords as ca x cb Boolean matrices. Alice sends 
a random column of C(x) together with its index, sending ca + logce bits in total. Bob sends a 
random row of C(y) with its index, sending cb + logc^ bits. The referee checks whether the row 
and column agree in the one point where they intersect. If x = y then the two bits are the same, 
otherwise they differ with constant probability. Repeating a constant number of times, we obtain 
a bounded-error private-coin SMP protocol where Alice sends 0{ca + logce) bits and Bob sends 
0(cb -f logc^) bits. 

Note that Theorem [2] fails spectacularly for public-coin SMP protocols: the bounded-error 
public-coin SMP complexity of Equality is constant, while a deterministic player needs to send 
n bits, no matter what the other player sends. 

4 Replacing a quantum message by a randomized one 

We now prove that in quantum-classical SMP protocols, the "quantum leg" of the protocol can be 
replaced by a randomized message. 



Theorem 4. Let f be a (possibly partial) Boolean function. If there is a private-coin (resp. public- 
coin) bounded-error quantum- classical SMP protocol for f where Alice sends qA qubits and Bob 
sends cb classical bits, then there is a private-coin (resp. public-coin) bounded-error SMP protocol 
for f where Alice sends O(qACB) classical bits and Bob sends cb classical bits. 

Proof: We prove the theorem for private-coin protocols. The proof for public-coin protocols is 
essentially the same, just fix the shared randomness at the start of the argument and average over 
it at the end. In general the three-party protocol has the following form: Alice sends the referee 
a qA-qubit density matrix p x , while Bob sends a classical message b £ {0, 1} CS , whose distribution 
depends on his input y. The referee then measures p x with a measurement operator Ef,, and outputs 
1 if the measurement accepts (which happens with probability pf, = Tr(Ebp x )). 

The SMP protocol promised by the theorem is as follows: Bob sends a c^-bit message b, 
exactly as in the original quantum-classical protocol. Using Theorem [IJ Alice sends to the referee 
a randomized message of 0(qACs) bits to enable him to obtain with probability at least 1 — 8 an 
approximation pb to pb = Tr(Ef,p x ) to within ±5, where 5 = 1/10. Finally, the referee outputs 1 
with probability pi,) an d otherwise. The overall error probability is at most 25 worse than in the 
original protocol. ■ 

Note the difference between the above two proofs. The proof of Theorem [2] obtains approxima- 
tions pb for all b £ {0, l} Cs simultaneously, which enables the referee to learn f(x,y) for each y. 
On the other hand, the proof of Theorem U] only obtains an approximation pb for the specific b that 
the referee received from Bob, which enables the referee to predict f{x,y) for the specific input y 
that Bob holds. 

5 Replacing a quantum message by a deterministic one 

By combining Theorem with the Babai-Kimmel theorem (Theorem [2]), we see that in every 
quantum-classical private-coin SMP protocol with qA qubits and cb bits, we can replace Alice's 
message by a deterministic message of 0(qAC B ) bits. However, we can obtain something that is 
usually stronger, namely a deterministic message of 0(qACs log qA) bits. The crucial tool is the 
following result, which is an extension of a result of Aaronson [1, Theorem 3.4]: 

Theorem 5. For all 5 > the following holds. Suppose Alice has the classical description of an 
arbitrary q-qubit density matrix p, and Bob has 2 C measurements operators {Eb}b£{o,i} c - There is a 
deterministic message of 0{qc log q) bits from Alice that enables Bob to output values p' b satisfying 
that \pb — p' b \ < $ simultaneously for all b G {0, 1} C where pb = Tic(Ebp). 

It is interesting to compare this with Theorem [H While Theorem Q] allows us to approximate one 
Pb to within ±<5 (with some small probability of error) using an 0(qc)-bit message, Theorem [5] allows 
us to approximate all pb to within ±<5 (without probability of error) at the expense of increasing 
the message length by a factor logq. Theorem [5] generalizes Aaronson's pQ Theorem 3.4], which 
proves the special case where Tr(Ebp) is close to or 1 for all b. Our proof is a modification of his. 
We conjecture that the logq factor is not needed. 

Proof: Suppose Alice sends r = 0(\ogq) many copies of her state, for sufficiently large constant 
in the O(-) which may depend on 5. Let p' = p® r be the state she sends, and K = rq = O(qlogq) 
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(i) 
where E^ applies Ef, to the jth copy. This measures the fraction of successes if you separately 

measure each of the r copies of p with E\,. Since r = O(logg), a Chernoff bound implies that the 

outcome p' h of this measurement applied to p' will probably be close to its expectation pb = Tt(Ebp): 

Pr[|p£-p 6 |>ty4]<l/poly( g ). (1) 

Alice's classical message. Consider all b = 1, . . . , 2 C in order. We will sequentially build 
a sequence of -RT-qubit density matrices pb, one for each Ef,. Alice's classical message will enable 
Bob to reconstruct this entire sequence. Call b good if \Tr(FbPb) — Pb\ < 5; call b bad otherwise. 
Note that if Bob has a classical description of a good pb, then he can approximate pb to within 
±5 (since he knows what F\, is). We start with the completely mixed state: p\ = Ij1 K and define 
the subsequent pb one by one, as follows. If b is good, then define pb+i to be equal to pb- If b is 
bad, Alice appends the pair (b,pb) to her message, where pb is the log(l/<5) + O(l) most significant 
bits of pb, so \pb — Pb\ <C 8- In this case, let Mb be the projector on the subspace spanned by 
the eigenvectors of Fb with eigenvalues in the interval \pb — o~/2,Pb + ^/2], and let pb+\ be the 
renormalized projection of pb on this subspaceo Continuing all the way to b = 2 C , we obtain a 
message (&i, j^), • • • , (bT,Pb T ) for some T. We need to show two things: (1) this message enables 
Bob to approximate all pb to within ±5, and (2) T = O(K), which implies that the message length 
is 0(qc log q) bits. We will show these two things in turn. 

(1) Why this works. Note that Bob knows which b £ [2 C ] are bad, since those b are exactly 
the ones in Alice's message. Bob can in fact compute the whole sequence p\,...,p^ given the 
message: p\ = I/2 K ; if b is good then pb+\ = pb', if b is bad then (b,pb) is part of Alice's message 
and pb+i can be computed from this information. Suppose Bob wants to approximate pb = Tr(Ebp). 
If b is good then by definition \Tr(FbPb) — Pb\ < 5 and Bob can calculate Tr(FbPb)- If b is bad, then 
the pair (b,pb) is part of Alice's message, so Bob knows pb with sufficient precision. Hence Bob can 
approximate all pb up to ±<5, for all b simultaneously. 

(2) Why the message is not too long. Here we show T = 0{K). Define r] = 1 — 5/4 and 
t = \{K + l)/log(l/7?) + 1] = 0(K). Suppose, by way of contradiction, that T > t. We consider 
the sequence b\, . . . , bt of the first t bad b's. Let 

p = Ti[Mb t ---Mb 1 ^ R Mb 1 ---M bt 

be the probability that all t measurements succeed if we start with the completely mixed state and 
sequentially measure Mb l , ■ ■ ■ , Mb t ■ We will derive contradicting upper and lower bounds on p. 

First, the upper bound on p. If we sequentially measure M bl , . . . ,Mb t , starting from the com- 
pletely mixed state, and if all t measurements succeed, then we exactly have the sequence of density 



2 An observable F is a Hermitian matrix that describes a measurement, as follows. By diagonalization we can write 
F — Y^i A»i», where Pi is the projector on the eigenspace corresponding to eigenvalue A;. These eigenspaces are all 
orthogonal to each other and '}2 i Pi — I. The corresponding measurement on a density matrix p gives outcome A^ 
with probability Tr(Pip). Hence the expectation of the measurement is J^ XiTr(Pip) — Tr(Fp). 

The fact that this projection is nonzero (and hence can be renormalized to have trace 1) follows from the argument 
in the "Second, the lower bound on p" paragraph below. 



matrices p bl = I/2 K , . . . ,p bt ,p bt+ \. We claim that if pb is bad, then Tr(M b pb) < f], and hence the 
probability that all t measurements succeed is p < rf . The claim follows easily from a Markov 
argument: Let X denote the random variable representing the outcome of measuring pb with the 
observable Fb. Notice that X takes values in [0,1]. Assume Tr(Mbpb) = Pr[|X — pb\ < 5/2] > n. 
Then Tr(FbPb) = E[X] must necessarily be in the range 

[riipb - 5/2), v (p b + 5/2) + 1 - rj\ C \p b - 35/4,p b + 35/4] C [p b -5, Pb + 5], 

and hence p b is good. 

Second, the lower bound on p. Note that M b succeeds on p' iff the outcome p' b of the observable 
Fb is at most 5/2 away from the number p b , which is the truncated version of pb = Tr(E b p) (recall 
\Pb — Pb\ Ci). Hence by Eq. ([1]), we have 

Tr(ilV) = Pv[\p' b -p b \ < 5/2] > Pi[\p' b - Pb \ < 5/4] > 1 - l/poly(g). 

This allows us to measure p' with M b while disturbing the state by only an insignificant amount Q 
If we measure each of M b , for the first t bad b's in sequence, starting in p' , then with probability 
at least 1/2 all measurements will succeed. However, the completely mixed state can be written 
as oTT = 2^p' + (1 — jf)p" where p" is orthogonal to p'. Hence if we start from 1/2 , then the 
probability of all measurements succeeding is p > 1/2 . 

Combining the bounds of the last two paragraphs together with our value of t gives a contra- 
diction. ■ 

Corollary 6. Let f be a (possibly partial) Boolean function. If there is a bounded-error quantum- 
classical private-coin SMP protocol for f where Alice sends qA qubits and Bob sends cb bits, 
then there is a bounded-error private-coin SMP protocol for f where Alice deterministically sends 
0(qACB^ogqA) bits, and Bob (who is still randomized) sends cb bits. 

Proof: As in the proof of Theorem HI we assume without loss of generality that the protocol has 
the following form: Alice sends the referee a ^-qubit density matrix p x , while Bob sends a classical 
message b £ {0, l} Cs , whose distribution depends on his input y. The referee then measures p x 
with a measurement operator E b , and outputs 1 if the measurement accepts (which happens with 
probability p b = Tr (E b p x )). 

The desired SMP protocol is as follows: Bob sends a cg-bit message b, exactly as in the original 
quantum-classical protocol. Using Theorem Alice sends to the referee a deterministic message of 
0(qACB log qA) bits to enable him to obtain (with certainty) an approximation pb to pb = Tr(Ebp x ) 
to within ±5, where 5 = 1/10. Finally, the referee outputs 1 with probability pb, and otherwise. 
The overall error probability is at most 5 worse than in the original protocol. ■ 

As argued in Section [3l in a bounded-error protocol for Equality where Alice is deterministic, 
she needs to send at least n bits. Hence we obtain the following lower bound on quantum-classical 
private-coin SMP protocols for Equality, which is tight up to the y^ogn- factor. 

Corollary 7. Every quantum- classical private-coin SMP protocol for EQUALITY has communica- 
tion complexity Q.{yn/\ogn). 

4 This is a well-known and very intuitive property in quantum computing; we refrain from spelling out the quanti- 
tative details so as not to crowd out the intuition with even more technicalities (see for instance the "almost as good 
as new lemma" [l] Lemma 2.2]). 



6 Tightness 

The example of the Equality function shows that Theorems [5] and Corollary [6] are essentially 
tight. 

We do not know whether Theorem |4] is close to optimal, but at least it shows that the gap 
between quantum-classical and classical-classical SMP protocols is at most polynomial. The fol- 
lowing communication problem, adapted from [U EJ [8] , presents an interesting quantum-classical 
public-coin protocol that uses about n 1 ' 3 qubits. We do not know an equally efficient classical- 
classical public coin protocol for this problem; the best one we know sends about \/n bits. This 
suggests that quantum-classical SMP protocols can at least have some polynomial advantage over 
classical-classical protocols. 

The problem is as follows. Let n be an even integer. Alice receives x € {0, l} n , while Bob 
receives a perfect matching M (i.e., a partition of [n] = {1, . . . , n} into n/2 disjoint pairs, called 
"edges"), and a string w £ {0, l} n / 2 whose bits are indexed by the edges in M. We can view the 
edges of M as rows (of weight 2) in an n/2 x n matrix M over GF{2). Then the matrix- vector 
product Mx is the n/2-bit string obtained by taking, for each edge (i,j) of M in order, the XOR 
Xi © Xj . The promise is that the Hamming distance between w and Mx is either at most n/6 or at 
least n/3, and the function value is 1 in the first case and in the second. 

One can show easily that the deterministic complexity of the problem is f2(n), as follows. By the 
probabilistic method, there exists a set S C {0, l} n of size | *S' | = 2 ( n > such that all distinct i,i'eS 
are at distance around n/2. But then for each distinct x, x' S S we can find a matching M where 
the n/2-bit strings Mx and Mx' have distance close to n/2 (pick as many edges as possible that 
have one endpoint in a bitlocation where x and x' agree, and one endpoint where they disagree). 
Putting w = Mx, we have f(x,M,w) = 1 but f(x',M,w) = 0. Hence in a deterministic protocol, 
Alice will need to send a different message for each of the x £ S. Therefore the deterministic SMP 
(and even one-way) communication complexity of this function is O(n). 

On the other hand, here is a bounded-error public-coin SMP protocol where Alice sends q& ~ 
n 1 ' 3 qubits and Bob sends cb ~ n 1 ' 3 bits. Alice and Bob use the public coin to select a random 
subset S C [n] of about n 2 ' 3 elements from [n]. Now with high probability, MD (S x S) will contain 
0(n 1 ' 3 ) edges. Alice sends the referee n 1 ' 3 copies of the uniform superposition , ^2i e $(~ l) Xi \i)- 

Bob sends over ©(n 1 ' 3 ) edges in M n (S x S), together with the corresponding bits of w. The 
referee constructs two-dimensional measurement operators from the edges he received from Bob, 
and measures each of the quantum states with them. With probability close to 1, one of those 
measurements will succeed and give him a bit of the string Mx. Since the location of that bit in 
Mx is random, comparing that bit with the corresponding bit of w (which is part of Bob's message), 
gives the referee the function value with probability at least 2/3 lj 

7 Functional separations versus relational separations 

As mentioned before, Theorem d] implies that the gap between quantum-classical and classical- 
classical SMP protocols is at most polynomial for any Boolean function. In contrast, Bar-Yossef et 
al. [5] exhibited a relational problem for which quantum-classical SMP protocols are exponentially 



5 The best classical protocol that we know works similarly. It selects a set S of about y/n elements, and Alice 
sends the corresponding bits of x to the referee at the expense of about y/n bits of communication. 



better than classical-classical SMP protocols with a public coin. In a relational problem, for each 
input pair (x,y) there is a set of valid outputs z. In the case of [5], Alice receives an arbitrary 
string x £ {0, 1}" and Bob receives a perfect matching M on [n] from a set of 0(ra) possible perfect 
matchings. Their goal is to output any z of the form (i,j,Xi © Xj) where (i,j) £ M. 

Bar-Yossef et al. exhibit a quantum-classical SMP protocol that solves this problem with success 
probability 1, with a logn-qubit message from Alice to the referee and a logn-bit message from 
Bob. Their protocol works as follows: Alice sends the referee a uniform superposition 

n 



Bob sends the referee the index of his matching M in the set of G(n) possible matchings, which 
takes logra + 0(1) classical bits. Viewing M as a measurement consisting of n/2 orthogonal two- 
dimensional projectors (one for each edge (i,j) £ M), the referee measures the quantum state he 
received from Alice. This gives him the state 

i= ((-irii) + (-i)*'ii» = ^£ (io + (-ir e ^ij>) 

for a uniformly random edge (i,j) £ M. From this the referee can obtain the bit xi © Xj with 
certainty, and output (i,j,Xi © Xj) accordingly. No public coin is needed. In contrast, Bar-Yossef 
et al. proved a 0(y / re) bound for classical-classical public-coin protocols for this relational problem. 

To summarize, we see that when comparing the quantum-classical SMP model to the classical- 
classical SMP model, one can obtain an exponential separation for a relation but not for a Boolean 
function. In the remainder of this section we show that such a situation cannot occur for purely 
classical models. More precisely, we show that for models obeying the Yao principle [15] (defined 
next), any separation for a relation implies a similar separation for a function (and sometimes even 
for a Boolean function). Notice that the converse implications clearly holds, i.e., a separation for a 
functional problem is also a separation for a relational problem, since functions are a special case 
of relations. 

Consider any computational model that has a class of deterministic algorithms (or protocols), 
each of a certain cost. A randomized algorithm in such a model is a probability distribution over 
deterministic algorithms. The Yao principle states the equality of two different complexities: (1) the 
e-error complexity (the minimal cost of randomized algorithms whose error probability is at most e 
on every input) and (2) the e-error distributional complexity under the hardest input distribution fi 
(the minimal cost of deterministic protocols that have error probability at most e under fi). Because 
of the minimax theorem from game theory, allowing shared randomness in one's communication 
model is a sufficient condition for the Yao principle to hold. 

Now assume any two computational models, both obeying the Yao principle. Call these models 
"a" and "b", respectively. Let R a)£ and R\, :£ denote the e-error complexities in these two models. 
Assume we have a separation between these two models, showing that R a ,2e(P) is greater than 
Rb,e{P) for some relational problem P. We will next show how to construct a function / for which 
there is a separation between R a ^ e (f) and Rb. £ (f) that is at least as large. 

Let \i be a worst-case input distribution for the distributional i? aj 2 e -complexity of relation P. 
That is, any deterministic protocol in the "a" model solving P with distributional error at most 2e 
under //, must use at least R a ,2e{P) bits of communication. Next, by the Yao principle, there is a 
deterministic protocol in the "b" model solving P with error at most e under distribution /i, using at 
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most Rb t£ (P) bits of communication. Being deterministic, this protocol necessarily computes some 
function with error probability 0, call it /. Hence we see that for this function, Rf, t£ (P) > _R(,,o(/)- 
Moreover, note that the probability under [i that f(x,y) is not a valid answer for P, is at most e. 

To complete the argument, we now show that R a ,e(f) > Ra2e(P)- Consider an optimal £-error 
protocol for / in the "a" model with complexity R aE (f). By the Yao principle, there exists a 
deterministic protocol for / in the "a" model with distributional error at most e under \x, and the 
same complexity. By the union bound, the same protocol computes P with distributional error at 
most 2e under fi. The desired inequality R at£ (f) > R at 2 £ (P) now follows from the choice of \i. In 
sum, we have found a function / with R a>£ (f) > R a ,2e(P) > Rb,e{P) > Rb,o(f) > Rb,e(f)- 

The separation we obtained above is for a functional problem, but not necessarily a Boolean 
one. We now observe that if the i? a /i?b-separation we start with is sufficiently strong, and the 
number of output bits of P is not too large, then one can obtain a Boolean function with a strong 
-R a /Zf!b-separation. Assume / has a A;-bit output, and assume that g : {0, l} fc — ► {0, l} 10fc is an 
error-correcting code with constant rate and constant relative distance (which is known to exist). 
Let /i, . . . , /iofc be the Boolean functions representing the bits of g(f(-)). Having e-error protocols 
for each of these Boolean functions, each of complexity c, implies an e-error protocol for / of 
complexity O(ck). Hence for at least one j we have R a , £ {fj) = Q(Ra,e(f)/k). Accordingly, if the 
original relational i? a /ifVseparation was by more than a factor k, then we now have a R a /Rb- 
separation for a Boolean function. 
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